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DETAILED ACTION 

1. Amendment received on 08/20/2008 has been entered into record. Claims 1, 12- 
13 and 17-20 are amended. Claims 1-20 are currently pending. 

Priority 

2. This application has claimed priority from provisional application 60528643 filed 
on 12/10/2003. The filing date is 03/30/2004. 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless — 

(e) the invention was described in (1) an application for patent, published under 
section 122(b), by another filed in the United States before the invention by the 
applicant for patent or (2) a patent granted on an application for patent by another 
filed in the United States before the invention by the applicant for patent, except that 
an international application filed under the treaty defined in section 351(a) shall have 
the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published 
under Article 21(2) of such treaty in the English language. 

Claims 1-7 and 9 are rejected under 35 U.S.C. 102(e) as being anticipated by Rowley 

et al. (US 7277957 B2), hereinafter referred as Rowley. 

a. Regarding claim 1, Rowley disclosed an apparatus (Fig. 1 and Fig. 2) 

comprising: a network interface module to connect the apparatus to a network 
(column 3, lines 28-33; Ethernet card as a network tap device); a packet 
capture module to intercept packets being transmitted on the network (column 
3, lines 33-35: a packet capture engine); an object assembly module to 
reconstruct flows representing objects being transmitted on the network from 
the intercepted packets (column 4, lines 9-12: packets are sequentially read, 
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decoded, checked and added to the protocol sorted list until the last packet has 
been retrieved; column 4, lines 29-34: data from the selected packets may be 
reconstructed into data files and script files used to display web pages and 
other content; column 6, lines 59-65: local cache holding word processing 
documents, PDF files, audio files and video files); an object classification 
module to determine a type of content of (column 4, lines 63-65: determine 
the type of packets; column 6, lines 6-11: packet indicates a script file type to 
be displayed as page, e.g. HTML, Java Script and Active Server Pages; multi- 
packet recompilation module set similar directories for local cache of files) 
and reconstruct objects from flows (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until 
the last packet has been retrieved; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files); an object 
store module to store the objects (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until 
the last packet has been retrieved); and a user interface to enable a user to 
search objects stored in the object store module (column 7, line 66-column 8, 
line 1 : web browser or display program capable display text, graphic and other 
visual information on a computer monitor), 
b. Regarding claim 2, Rowley disclosed the apparatus of claim 1, wherein the 
object assembly module comprises a reassembler to assemble the intercepted 
packets into flows (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has 
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been retrieved; column 6, lines 59-65: local cache holding word processing 
documents, PDF files, audio files and video files). 

c. Regarding claim 3, Rowley disclosed the apparatus of claim 2, wherein the 
object assembly module further comprises a protocol demultiplexer to sort the 
assembled flows by protocol (column 4, lines 9-12: packets are sequentially 
read, decoded, checked and added to the protocol sorted list until the last 
packet has been retrieved ; column 6, lines 59-65: local cache holding word 
processing documents, PDF files, audio files and video files). 

d. Regarding claim 4, Rowley disclosed the apparatus of claim 3, wherein the 
object assembly module further comprises a protocol classifier to extract the 
objects from the sorted assembled flows (column 4, lines 9-12: packets are 
sequentially read, decoded, checked and added to the protocol sorted list until 
the last packet has been retrieved ; column 6, lines 59-65: local cache holding 
word processing documents, PDF files, audio files and video files). 

e. Regarding claim 5, Rowley disclosed the apparatus of claim 1, wherein the 
object classification module determines whether objects are stored in the 
object store or discarded based on one or more capture rules (column 3, lines 
62-67: packet not needed for the subsequent reconstruction of the network 
communication session). 

f. Regarding claim 6, Rowley disclosed the apparatus of claim 5, wherein the 
capture rules are user-configurable through the user interface (column 1 , line 
66-column 2, line 9: selecting a portion of the packets captured by a sniffer 
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during a giving time interval; column 3, lines 43-47: selecting captured data 
during a specified time interval). 

g. Regarding claim 7, Rowley disclosed the apparatus of claim 1, wherein the 
object classification module determines a location that each object is stored in 
the object store based on the type of content of each object (column 6, lines 
38-48: directory structure based on image file type; column 6, lines 49-65: 
directory structure for graphics files, text files, audio files and video files). 

h. Regarding claim 9, Rowley disclosed the apparatus of claim 1 , wherein the 
user interface comprises a graphical user interface (column 7, line 66-column 
8, line 1 : web browser or display program capable display text, graphic and 
other visual information on a computer monitor). 

Rowley disclosed all limitations of claims 1-7 and 9. Claims 1-7 and 9 are rejected 
under 35 U.S.C. 102(e). 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a 
whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability 
shall not be negatived by the manner in which the invention was made. 

Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over Rowley and 

further in view of Saulpaugh et al. (US 7072967 Bl), hereinafter referred as 

Saulpaugh. 
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a. Rowley shows claim 1 as above. Rowley docs not show (claim 8) wherein the 
object classification module determines the type of content of each object 
using a signature of each object. 

b. Saulpaugh shows (claim 8) wherein the object classification module 
determines the type of content of each object using a signature of each object 
(column 82, lines 28-52: an object signature may be included to identify the 
object's class) ^ N v efficient construction of 
message endpoints. 

c. It would have been obvious to a person of ordinal \ s s - \ 

no 1 <n vs as made to modify Rowley's functions of reconstructing 
network communications with Saulpaugh 's functions of identifying object 
class with an object signature. 

d. The modification would have been obvious because one of ordinary skill, in 
the art would have been motivated to identify an object class with an object 
signature as per Saulpaugh' s teaching in the art of communication 
reconstruction as per Rowley (column 1, lines 54-65) and Saulpaugh (column 
27, lines 1 0-29) 's teaching. 

Together Rowley and Saulpaugh disclosed all limitations of claim 8. Claim 8 is 

rejected under 35 U.S.C. 103(a). 
5. Claims 10-1 1 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Rowley and further in view of Barnett et al. (US 7290048 Bl), hereinafter referred as 
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a. Rowley shows claim 1 as above. Rowley docs s -s * k< -w (claim 10) wherein 
the object store module comprises a content store to store the objects and a tag 
store to index the objects stored in the object store. However, Rowley c • } 
show identifying protocol and collecting packets into a protocol sorted list; 
selecting, reconstructing and displaying data information, e.g. web pages, 
from a protocol session. 

b. Barnctt shows (claim 10) wherein the object store module comprises a content 
store to store the objects and a tag store to index the objects stored in the 
object store (column 10, lines 52-61: tags and other columns support 
transaction recognition, pointer to original sources of data for traceability; 
column 22, lines 18-37: tags interpreted are time, data, file name, line 
numbers, graph object types, source, destination and tool tip information) in 
an, » >\o, * lor the purpose of data collection, data analysis, and model 
generation for the performance analysis of enterprise applications. 

c. h would have been obvious to a person of ordinary skill in the art at the time 
^ % e w - snade to modify Rowley's functions of reconstructing 
network communications with Barnett's functions of using tags in support of 
performance analysis. 

d. N o s w ->c one of ordinary skill in 
Ihe vun;U h,o c Koo N > , ,e 10 tag and identify data as per Barnett's 
teaching in support the data collection and reconstruct as per Rowley (column 
1, lines 54-65) and Barnett (column 7, lines 35-45)'s teaching. 
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e. Regarding claim 11, Barnett shows wherein the content store comprises a 
canonical storage, and the tag store comprises a database (column 12, lines 4- 
12: canonical form for abstract module, sources supply lines information form 
text file, binary file or database; column 13, lines 26-48: data consists of 
network traces consisting of arrays mutated into hash tables to be addresses by 
column header vs. row and column locations). 
Together Rowley and Barnett disclosed all limitations of claims 10-11. Claims 10-1 1 
are rejected under 35 U.S.C. 103(a). 

6. Claims 12-14 and 17-19 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Rowley in view of Barnett. 

a. Rowley shows (claim 12) an method comprising: intercepting data being 
transmitted on a network (column 3, lines 33-35: a packet capture engine); 
reconstructing flows of objects being transmitted on the network from the 
intercepted data (column 4, lines 9-12: packets are sequentially read, decoded, 
checked and added to the protocol sorted list until the last packet has been 
retrieved; column 4, lines 29-34: data from the selected packets may be 
reconstructed into data files and script files used to display web pages and 
other content; column 6, lines 59-65: local cache holding word processing 
documents, PDF files, audio files and video files); classifying the 
reconstructed objects by content type (column 4, lines 63-65: determine the 
type of packets; column 6, lines 6-11: packet indicates a script file type to be 
displayed as page, e.g. HTML, Java Script and Active Server Pages); and 
storing the classified objects (column 4, lines 9-12: packets are sequentially 
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read, decoded, checked and added to the protocol sorted list until the last 
packet has been retrieved). Rowley l> vs s-n sv-w (claim 12) creating a tag to 
describe each reconstructed object; storing tags; indexing the stored objects to 
enable searching of the stored objects via the tags. However, Rowley does 
show identifying protocol and collecting packets into a protocol sorted list as 
per IP address and port number to categorize packets (column 4, lines 42-65); 
selecting, reconstructing and displaying data information, e.g. web pages, 
from a protocol session, including the directory and file structures (column 7, 
lines 37-51). 

b. Barnctt shows (claim 12) creating a tag to describe each reconstructed object; 
storing tags; storing tags; indexing the stored objects to enable searching of 
the stored objects via the tags (column 10, lines 52-61 : tags and other columns 
support transaction recognition, pointer to original sources of data for 
traceability; column 22, lines 18-37: tags interpreted are time, data, file name, 
line numbers, graph object types, source, destination and tool tip information) 
in an analogous art for the purpose of data collection, data analysis, and model 
generation for the performance analysis of enterprise applications. 

c. h would hi- e kv«t i-K • :s to a person of ordinary skill in the art at the time 

c - lade to n s Rowley's functions of reconstructing 
network communications with Barnett's functions of using tags in support of 
performance analysis. 

d. 1 he modification would have been obvious because or?e of ordinary skill in 

ould h en - , N tag and identify data as per Barnett's 
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teaching in support the data collection and reconstruct as per Rowley (column 
1, lines 54-65) and Barnett (column 7, lines 35-45)'s teaching. 

e. Regarding claim 13, Rowley shows wherein reconstructing the objects 
comprises: sorting the intercepted data into packets; and sorting the assembled 
flows by protocol (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has 
been retrieved ; column 6, lines 59-65: local cache holding word processing 
documents, PDF files, audio files and video files). 

f. Regarding claim 14, Rowley shows further comprising determining whether 
each object is to be stored based on a set of one or more capture rules (column 
3, lines 62-67: packet not needed for the subsequent reconstruction of the 
network communication session). 

g. Regarding claim 17, Rowley shows an machine-readable storage medium 
having stored thereon data representing instructions (Fig. 1 and Fig. 2) that, 
when executed by a processor, cause the processor to perform operations 
comprising: intercepting data being transmitted on a network (column 3, lines 
33-35: a packet capture engine); reconstructing objects being transmitted on 
the network from the intercepted data (column 4, lines 29-34: data from the 
selected packets may be reconstructed into data files and script files used to 
display web pages and other content); classifying the reconstructed objects by 
content type (column 4, lines 63-65: determine the type of packets; column 6, 
lines 6-1 1 : packet indicates a script file type to be displayed as page, e.g. 
HTML, Java Script and Active Server Pages); and storing the classified 
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objects (column 4, lines 9-12: packets are sequentially read, decoded, checked 
and added to the protocol sorted list until the last packet has been retrieved). 
Barnett shows creating a tag to describe each reconstructed object; storing 
tags; storing tags; indexing the stored objects to enable searching of the stored 
objects via the tags (column 10, lines 52-61 : tags and other columns support 
transaction recognition, pointer to original sources of data for traceability; 
column 22, lines 18-37: tags interpreted are time, data, file name, line 
numbers, graph object types, source, destination and tool tip information). 

h. Regarding claim 18, Rowley .shows wherein reconstructing the objects 
comprises: sorting the intercepted data into packets; and sorting the assembled 
flows by protocol (column 4, lines 9-12: packets are sequentially read, 
decoded, checked and added to the protocol sorted list until the last packet has 
been retrieved ; column 6, lines 59-65: local cache holding word processing 
documents, PDF files, audio files and video files). 

i. Regarding claim 19, Rowley shows wherein the instructions further cause the 
processor to determine whether each object is to be stored based on a set of 
one or more capture rules (column 3, lines 62-67: packet not needed for the 
subsequent reconstruction of the network communication session). 

Together Rowley and Barnett disclosed all limitations of claims 12-14 and 17-19. 

Claims 12-14 and 17-19 are rejected under 35 U.S.C. 103(a). 
7. Claims 15-16 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Rowley, Barnett and further in view of Saulpaugh. 
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a. Rowley and Barnett show claims 12 and 17 as above, \euh.r Rowley nor 
Barnett shows (claim 15) further comprising receiving a query over the stored 
objects and (claim 16) further comprising searching the indexed objects, and 
retrieving objects matching the query. However, as per claim 10 rejection 
Barnett docs show that user selects based on tags. 

b. Saulpaugh shows (column 27, lines 10-29) query for a message response; 
(column 41, line 60-column 42, lines 10) database query based upon name or 
strings; and (column 48, lines 33-52) query results cache in an analogous art 

1 - v •> > pos- of efficient construction of message endpoints. 

c. It would have been obvious to a person of ordinan - \ , a: uv tunc 

o ^ % ^ Rowley's functions of reconstructing 

network communications with Barnett's functions of using tags in support of 
performance analysis and Saulpaugh's functions of message query based on 
name or string. 

d. The modification would have been obvious beca use one of ordinary skill in 

v, \ \\\ i> tag and identify data as per Barnett's 

teaching and have data selection or query based on name or string as per 
Saulpaugh's teaching in support the data collection and reconstruct as per 
Rowley (column 1, lines 54-65) and Barnett (column 7, lines 35-45)'s 
teaching. 

e. Regarding claim 20, Saulpaugh shows wherein the instructions further cause 
the processor to receive a query over the stored objects, search the indexed 
objects in response to the query, and retrieve objects matching the query 
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(column 27, lines 10-29: query for a message response; column 41, line 60- 
column 42, lines 10: database query based upon name or strings; column 48, 
lines 33-52: query results cache). 

Together Rowley, Barnett and Saulpaugh disclosed all limitations of claims 15-16 

and 20. Claims 15-16 and 20 are rejected under 35 U.S.C. 103(a). 
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Response to Arguments 

8. Applicant's arguments filed on 06/26/2008 have been fully considered, but they 
are not persuasive. 

a. Applicant argued (3 rd paragraph on page 8 of current amendment) that Rowley 
does not describe any module to "determine a type of content of the 
reconstructed objects." Rowley has shown (column 4, lines 63-65) determine 
the type of packets and categorize packets in the list; and (column 6, lines 6- 

1 1) packet indicates a script file type to be displayed as page, e.g. HTML, 
Java Script and Active Server Pages. Rowley has further shown (column 6, 
lines 38-65) that the a multi-packet recompilation module will create 
directories similar to ones on a remote server for local cache to store files 
including graphic files, text files and video files. Thus Rowley has taught 
and/or suggested the argued limitation. 

b. Applicant argued (2 nd paragraph on page 9 of current amendment) that Barnett 
does not disclose the limitation of "indexing the stored objects to enable 
searching of the stored objects". Barnett has shown (column 10, lines 52-61) 
tags and other columns support transaction recognition, pointer to original 
sources of data for traceability, and color coding tags for display purpose; and 
(column 22, lines 18-37) tags interpreted are time, data, file name, line 
numbers, graph object types, source, destination and tool tip information). 
These seem to read upon applicant's description on "tag" in paragraph 32 of 
applicant's specification. Barnett has further shown (column 19, line 58 
through column 10, line 40) hashing network data; and (column 12, lines 13- 
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40) filtering with a protocol tag; using filters based on criteria, report writers, 
or data modifiers. Barnett seems to indicate setting up some relational 
database for searching particular network trace data based upon some 'tags" 
or "other column annotations". In addition, Rowley does show selecting, 
reconstructing and displaying data information, e.g. web pages, from a 
protocol session, including the directory and file structures (column 7, lines 
37-51). Thus Barnett and/or Rowley have the argued limitation, 
c. Applicant has amended the independent claims 12 and 17 with addition 

limitation of "reconstructing flows of objects being transmitted on the network 
from the intercepted data", " creating a tag to describe each reconstructed 
object ", "storing the classified objects and tags " and "indexing the stored 
objects to enable searching of the stored objects via the tags ". Examiner has 
reviewed the limitations with respect to the whole claim language and in light 
of applicant's original specification and claim set. Examiner has reviewed the 
claim rejections and applied prior arts as per office action mailed 03/17/2008. 
It seems that Rowley and Barnett do have the limitations. Claim 12 and 17 
rejections are updated as above. 
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Conclusion 

9. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed 
within TWO MONTHS of the mailing date of this final action and the advisory action 
is not mailed until after the end of the THREE-MONTH shortened statutory period, 
then the shortened statutory period will expire on the date the advisory action is 
mailed, and any extension fee pursuant to 37 CFR 1 .136(a) will be calculated from 
the mailing date of the advisory action. In no event, however, will the statutory 
period for reply expire later than SIX MONTHS from the mailing date of this final 
action. 

10. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. Refer to the enclosed PTO-892 for details. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Peling A. Shaw whose telephone number is (571) 272- 
7968. The examiner can normally be reached on M-F 8:00 - 4:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William C. Vaughn can be reached on (571) 272-3922. The fax phone 
number for the organization where this application or proceeding is assigned is (571) 
273-8300. 

Information regarding the statu9s of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
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published applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 



/Peling A Shaw/ 
Examiner, Art Unit 2444 



